What an authorized push payment scam is
In an authorized push payment scam, a fraudster talks a person into sending money from their own account to an account the fraudster controls. The customer starts the transfer. The customer approves it. The deception is what drove the decision.
That is different from account takeover, where someone other than the account holder starts the payment. The two get mixed up often. The difference matters a great deal when a bank decides who bears the loss.
Why the usual protections often do not apply
Passwords, one-time passcodes and step-up checks are built to confirm who is at the keyboard. In a scam, the right person is at the keyboard. A coached customer completes every step, so those tools do not catch the problem, according to one vendor guide on payments fraud.
The reimbursement question runs into the same wall. The CFPB's Regulation E guidance covers electronic fund transfers, including some person-to-person and mobile payments. Its protection centers on unauthorized transfers, which generally means someone other than the consumer started them. A payment the customer sent while deceived may not fit that definition. Vendor material we reviewed says there is no federal reimbursement mandate for a payment the customer authorized, and that the loss generally stays with the consumer. Treat that as a reading to confirm against the CFPB's own Regulation E FAQs or a qualified adviser. It is not a promise about any single case.
Other payment rails add their own wrinkles. One vendor source notes that for wires under UCC Article 4A, a bank has no general duty to accept a payment order. It also says Nacha has fraud-monitoring rules for ACH that touch credits sent under false pretenses. Which rule applies depends on how the money moved, and those claims come from a vendor, so verify them.
How the UK handles it differently
The UK offers a useful contrast. According to a vendor comparison, since 7 October 2024 in-scope victims of Faster Payments and CHAPS fraud can get mandatory reimbursement of up to £85,000 per claim. Sending and receiving firms split the cost 50:50. Sending banks may also delay a suspicious payment, up to the end of the fourth day, if they have reasonable grounds and notify the customer by the end of the first day.
The same comparison says the US has no equivalent delay power. This is a vendor's summary, so check details against official UK sources before relying on them. The point for US readers is narrower. A different legal design produces a different answer to who pays.
What a bank can do before the money leaves
Once funds are gone, recovery is uncertain. So the sources focus on the moments before the send button. Banks can combine signals: a new payee, the first use of a payment rail, an unusual amount or pace, signs of remote access or coaching during the session, and risk on the receiving account.
Then they can act. Specific warnings help more than generic ones. Questions that adapt to the customer's answers can expose a script. Holds and outbound calls give a second chance to think. Some customers will still insist on sending after every warning. The realistic goal is timely intervention, not a guarantee.
The sources do not rank banks or payment apps on any of this. A reader can still look at what an institution says it does before a payment goes out, and use the steps above as a checklist.
Questions to ask and red flags to notice
Three questions are worth putting to your own bank or payment provider.
- Does it warn me or hold a payment when the payee is new or the amount is unusual for me?
- Does it ask questions before a payment goes out, and what happens if I insist on sending?
- Which rules cover my transfer, Regulation E or a network rule such as Nacha's, and do they reach a payment I authorized myself?
Some warning signs show up again and again in the sources.
- A caller says they are the bank's fraud team or a government agency.
- Someone coaches you during the session or has remote access to your device.
- The payee is new and the amount or pace is unlike your normal activity.
If two or more of these appear together, stop and end the contact. Then reach the bank through a number you already trust, such as the one on your card. That is general caution, not a recovery method.
What nobody can tell you yet
The data is thin. The GAO has said there is no government-wide strategy to counter scams, no government-wide estimate of losses and no common definition of a scam. Its report is available at gao.gov. So any single national loss figure for this type of fraud deserves suspicion.
The FDIC issued a 2025 Request for Information on potential actions to address payments fraud. We could not confirm what came of it. The sources here also do not explain how to report a scam to the FTC, CFPB or FBI, how state law treats scam losses, or how a given bank's policy applies to your account.
Whether a bank reimburses an authorized payment depends on the rail, the rules and the bank's own policy. None of those are guaranteed. This article is educational and is not legal or financial advice.
Please seek a professional. This article is general information, not financial, tax or insurance advice. Please seek a licensed financial, tax or insurance professional about your own situation.
